A small customer focused bank with implemented least privilege principles, is concerned about the possibility of branch staff unintentionally aiding fraud in their day to day interactions with…

An information disclosure policy defines what data may or may not be shared but does not equip staff with the skills to recognize when a trusted customer relationship is being deliberately exploited to facilitate fraud.

Awareness training teaches employees to recognize social engineering tactics that fraudsters use to exploit personal trust and friendly relationships, which is the specific risk the security and risk team identified. It gives staff the practical knowledge to maintain personalized customer service while protecting against manipulation, directly targeting the unintentional nature of the threat. Because least privilege is already implemented, the remaining control gap is the human element - recognizing and resisting exploitation of those relationships.

Job rotation moves employees between roles and can reduce collusion risk over time, but it does not address the immediate threat of staff being socially engineered during routine, friendly customer interactions.

Separation of duties divides critical tasks among multiple people to prevent single-point fraud, but the concern is unintentional aid driven by interpersonal manipulation, which procedural task division alone cannot prevent.